X6 SS Acquisition Corporation (d/b/a Sendspark, Inc.)

Effective date: November 3, 2026

This Data Processing Addendum (“DPA”) forms part of the Sendspark Terms of Service or other written agreement between Sendspark and the Customer for the Services (the “Main Agreement”). It applies where Sendspark processes Personal Data on the Customer’s behalf in providing the Services. It is incorporated into the Main Agreement by reference and takes effect without signature. A countersigned copy is available on request to privacy@sendspark.com.

Definitions and variables

Term	Meaning
Parties’ relationship	Controller to Processor
Parties’ roles	The Customer acts as the Controller. X6 SS Acquisition Corporation (d/b/a Sendspark, Inc.) (“Sendspark”) acts as the Processor
Processor details and contact	X6 SS Acquisition Corporation (d/b/a Sendspark, Inc.), 2033 Gateway Place, Suite 500, San Jose, CA 95110, USA. Privacy team, privacy@sendspark.com
Controller contact	The account owner email on the Customer’s Sendspark account, or another address the Customer gives Sendspark in writing
Main Agreement	The Sendspark Terms of Service at https://www.sendspark.com/terms, or the order form and agreement signed between the parties
Term	This DPA continues until termination of the Main Agreement and, after that, for as long as Sendspark processes Personal Data on the Customer’s behalf
Breach Notification Period	Without undue delay and in any event within 72 hours after becoming aware of a personal data breach
Sub-processor Notification Period	At least 30 days before a new sub-processor is granted access to Personal Data
Liability Cap	As set out in the Main Agreement
Governing Law and Jurisdiction	As per the Main Agreement, except where the Transfer Mechanism requires otherwise
Data Protection Laws	All laws and regulations that apply to the processing of Personal Data under this DPA, including, where applicable, Regulation (EU) 2016/679 (GDPR), the UK GDPR and Data Protection Act 2018, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA), each as amended from time to time
Services	A video platform enabling users to record, create, personalize and share videos for sales, marketing and customer communication, including optional AI features, as further described at https://www.sendspark.com/
Duration of processing	For the Term of this DPA
Nature and purpose of processing	Hosting, storing, transcoding, generating, personalizing, transmitting and displaying videos and related content, and otherwise providing, securing and supporting the Services
Personal Data	Names, email addresses, job and company details; prospect and contact records the Customer uploads; video and audio recordings; generated videos; usage and technical data. Where a user opts in to AI features: a Voiceprint and a scan of face geometry (see Special provisions)
Data subjects	The Customer’s authorized users, and the Customer’s clients, prospective clients and other contacts whose data the Customer submits
Special provisions	Biometric information. A Voiceprint and a face geometry scan are created only for a user who opts in and gives the separate consent in the Biometric Information Notice and Consent at https://www.sendspark.com/biometric-consent. They are used only to generate that user’s own videos within the Customer’s account, never to train, develop or improve any general, shared or foundation model, and never to benefit any other customer. The face geometry scan is used only while a video is being generated and is not retained. The Voiceprint is deleted without undue delay if the user withdraws consent, the account is deleted, or the user is removed from the account, and in any event no later than three months from creation. Annex 3 sets out the full retention schedule
Transfer Mechanism	For transfers from the EEA: the Standard Contractual Clauses approved by European Commission Decision (EU) 2021/914 of 4 June 2021, Module 2 (controller to processor). For transfers from the UK: those clauses as amended by the UK International Data Transfer Addendum

1. What is this DPA about?

1.1 Purpose. The parties enter into this DPA for the purpose of processing Personal Data in relation to the provision of the Services.

1.2 Definitions. In this DPA: adequate country means a country or territory recognized under Data Protection Laws as providing adequate protection for Personal Data; controller, data subject, personal data breach, process/processing, processor and supervisory authority have the meanings given in Data Protection Laws; Sub-processor means another processor engaged by the Processor to carry out specific processing activities in respect of Personal Data; capitalized terms in “Definitions and variables” have the meanings given there.

2. What are each party’s obligations?

2.1 Controller obligations. The Controller instructs the Processor to process Personal Data in accordance with this DPA, and is responsible for providing all notices and obtaining all consents, licenses and legal bases required to allow the Processor to process Personal Data, except that the Processor obtains each individual user’s consent to the creation and use of a Voiceprint and a face geometry scan directly from that user, through the Biometric Information Notice and Consent.

2.2 Processor obligations. The Processor will:

• only process Personal Data in accordance with this DPA and the Controller’s documented instructions, unless legally required to do otherwise;
• not sell, retain or use any Personal Data for any purpose other than as strictly permitted by this DPA and the Main Agreement;
• inform the Controller promptly if, in its opinion, any instruction infringes Data Protection Laws;
• at all times apply the technical and organizational measures described in Annex 1 to ensure a level of security appropriate to the risk, and in particular to protect against unauthorized or unlawful processing, and against accidental or unlawful loss, destruction, alteration, disclosure or damage of Personal Data;
• where Personal Data includes special categories of data or biometric information, apply additional security measures and meet any specific requirements of Data Protection Laws;
• notify the Controller of a personal data breach within the Breach Notification Period, and provide a description of the nature of the breach including the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed to address it, together with reasonable assistance as required by Data Protection Laws;
• not inform any third party of a personal data breach affecting the Controller’s Personal Data without the Controller’s prior written consent, except where required by law;
• ensure that anyone authorized to process Personal Data is bound by written confidentiality obligations;
• without undue delay, provide the Controller with reasonable assistance with data protection impact assessments, responses to data subject requests, and engagement with supervisory authorities;
• on request, provide the Controller with the information necessary to demonstrate its compliance with this DPA and Data Protection Laws;
• allow for audits at the Controller’s reasonable request, limited to once a year and to business hours except following a personal data breach. Sendspark’s current SOC 2 Type II report may be provided in satisfaction of an audit request where it covers the matters in question;
• forward to the Controller without delay any data subject request recognizably directed to the Controller;
• return Personal Data on the Controller’s written request or, absent a request, delete it once it is no longer required to provide the Services, in accordance with the retention schedule in Annex 3 and in any event within 12 months after the end of the Term, unless retention is legally required. On request, the Processor will certify deletion.

2.3 Warranties. Each party warrants that it, its staff and its subcontractors will comply with their respective obligations under Data Protection Laws for the Term and any applicable retention period.

3. Sub-processing

3.1 Use of sub-processors. The Controller gives general authorization for the Processor to engage the sub-processors listed at https://www.sendspark.com/subprocessors (Annex 2), subject to sections 3.2 to 3.4.

3.2 Notice. The Processor will give notice of its intention to engage a new sub-processor at least the Sub-processor Notification Period in advance, by updating the list at https://www.sendspark.com/subprocessors and by email to customers who have subscribed to updates at privacy@sendspark.com. The notice will identify the sub-processor, the processing location and the processing activities.

3.3 Objections. The Controller may object to a new sub-processor on reasonable grounds relating to the protection of Personal Data within 30 days of the notice. The parties will then work together promptly and in good faith to resolve the objection. If they cannot, either party may terminate the affected Services.

3.4 Sub-processor requirements. The Processor will impose on each sub-processor data protection terms no less protective than this DPA, including a prohibition on using Personal Data to train the sub-processor’s own models; ensure appropriate safeguards are in place before any international transfer to a sub-processor; and remain liable for the acts and omissions of its sub-processors as if they were its own.

4. International transfers

4.1 Instructions. The Processor may transfer Personal Data outside the EEA, the UK or an adequate country only on the Controller’s documented instructions, which include the provision of the Services from the United States, or as required by law.

4.2 Transfer Mechanism. Where a party located outside the EEA, the UK or an adequate country receives Personal Data, that party is the data importer, the other party is the data exporter, and the Transfer Mechanism applies.

4.3 Additional measures. If the Transfer Mechanism is insufficient to protect the transferred Personal Data, the data importer will promptly implement supplementary measures to protect it to the standard required by Data Protection Laws.

4.4 Government access requests. If the data importer receives a request from a public authority for access to Personal Data, it will, to the extent legally permitted, promptly inform the Controller, not respond without the Controller’s prior consent unless legally required, use reasonable efforts to obtain a waiver of any prohibition on notifying the Controller, check that the request is valid and made under enforceable legal process, and disclose only the minimum Personal Data necessary.

5. California

Where the CCPA applies, the Processor acts as a service provider to the Customer, processes Personal Data only for the business purposes set out in the Main Agreement and this DPA, and will not: (a) sell or share Personal Data; (b) retain, use or disclose Personal Data for any purpose other than those business purposes, or as otherwise permitted by the CCPA; (c) retain, use or disclose Personal Data outside the direct business relationship between the Customer and the Processor; or (d) combine Personal Data with personal information it receives from or on behalf of another person, except as permitted by the CCPA. The Processor will comply with its obligations under the CCPA and provide the level of privacy protection the CCPA requires, will notify the Customer if it can no longer meet those obligations, and will allow the Customer to take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Data.

6. General

6.1 Survival. Provisions intended to survive the Term remain in force.

6.2 Order of precedence. In a conflict, the Transfer Mechanism prevails over this DPA, and this DPA prevails over the Main Agreement in relation to Personal Data.

6.3 Separate signed agreements. Where the Customer and Sendspark have signed a separate data processing agreement, that agreement governs the processing it covers in place of this DPA.

6.4 Notices. Notices under this DPA must be in writing and sent to the contacts in “Definitions and variables”.

6.5 Third parties. Only the parties may enforce this DPA, except as provided in the Transfer Mechanism.

6.6 Changes. Sendspark may update this DPA to reflect changes in Data Protection Laws or the Services, provided the update does not materially reduce the protection given to Personal Data.

6.7 Governing law and jurisdiction. As set out in “Definitions and variables”.

Annex 1: Technical and organizational security measures

Sendspark maintains an information security program that is examined annually under SOC 2 Type II, and that includes:

• Access control and authentication. Role-based, least-privilege access to systems containing Personal Data; strong password policies and multi-factor authentication; formal access provisioning and deprovisioning; access reviews at least twice a year.
• Data protection. Encryption at rest using AES-256 across devices and cloud infrastructure; encryption in transit using TLS 1.2 or higher; separation of production and test environments, with sanitized data in test systems; secure retention and disposal procedures.
• Network and system security. Firewalls and secure cloud environments; vulnerability management through regular scans and third-party penetration tests; malware protection and automated patch management; segmented network architecture.
• Organizational and people controls. Confidentiality agreements for employees and vendors; background checks before employment; security awareness training within 30 days of hire and annually.
• Monitoring, logging and audit. Continuous monitoring of access, privileged activity and system health; logging of system access, user actions and changes to sensitive data; review of logs and prompt escalation of anomalies.
• Vendor and sub-processor oversight. Critical vendors hold SOC 2, ISO 27001 or an equivalent attestation; annual compliance review of high-risk vendors; written no-training terms with every sub-processor that processes biometric information, zero-retention terms with the sub-processors that process face geometry, and retention terms matching Annex 3 for the Voiceprint.

Annex 2: Sub-processors

The current list of sub-processors, with purpose, data processed and location, is published at https://www.sendspark.com/subprocessors and is incorporated into this DPA.

Annex 3: Retention schedule

Data	Held by	Retention
Face geometry scan	Sync Labs, OmniSync (during generation only)	Not retained. Used only while a video is being generated, then discarded. No facial template is stored
Voiceprint	ElevenLabs, on Sendspark’s behalf	Deleted without undue delay when the user withdraws consent, the account is deleted, or the user is removed from the account, and in any event no later than three months from creation
Original recordings and generated videos	Mux	Deleted on request, or no later than 30 days after the account is deactivated
Logs and technical records	Sendspark and its platform sub-processors	Kept for no longer than 12 months
Other Personal Data (account, contact, prospect and campaign data)	Sendspark and its platform sub-processors	Returned or deleted on request, or once no longer required to provide the Services, and in any event within 12 months after the end of the Term
Backups	Sendspark platform sub-processors	Overwritten in the ordinary backup cycle